Toward Discovering and Exploiting Private Server-Side Web APIs

Many service providers including large enterprises have released their own applications (apps) that incorporate HTTP clients to facilitate the communications with their servers. The workflows of and APIs used by a web app and its corresponding mobile app are not always the same. We call the APIs found in apps private web APIs in that they are only supposed to be invoked by apps that developed by the service providers themselves. However, checking the origin of an HTTP request is very difficult, and private web APIs can be easily invoked by other entities. Hence, it is imperative to study if private web APIs provide the same level of security checks and validations as their public counterparts. To automatically discover the undocumented private APIs in Android apps, we design a system that uses static analysis to find the activities that invoke web APIs. Our system then runs the discovered activities on a customized Android system to monitor its HTTP requests and responses. We evaluated our system on 76 popular apps on the Google Play market. Our system successfully run 48 apps and discovered many private server-side APIs from more than 30 apps. Further manual investigation discovered that 9 of the apps have vulnerabilities that would enable API misuse and session hijacking.